Working signout button

README.md

@@ -78,6 +78,8 @@ Appending a username to the root URL, such as `/alice`, opens that user's public
 
 Configuration APIs require a bearer token returned by the login endpoint. User configuration uses the identity in that token. Plugin administration additionally requires an administrator account; the development `alice` account is seeded as an administrator, while `bob` is a standard user.
 
+Users can change their password from the profile page. The current password is required, new passwords must contain at least 8 characters, and the endpoint is `PUT /api/user/password`.
+
 On the profile page, the authenticated username is displayed as read-only. Users can upload a PNG, JPEG, GIF, or WebP avatar up to 2 MB; uploaded files are stored in the persistent data volume and served by the application. Bio and email fields remain empty until the user provides values. Mastodon settings default to the `mastodon.social` instance and the `From my #LinkLog: "` post prefix.
 
 ## Run Tests
@@ -131,6 +133,7 @@ The main configurable values are:
 | `TRAEFIK_HOST` | hostname routed by Traefik | `localhost` |
 | `TRAEFIK_HTTP_PORT` | host port for the application proxy | `80` |
 | `TRAEFIK_DASHBOARD_PORT` | host port for the dashboard | `8080` |
+| `TRAEFIK_DASHBOARD_BIND_ADDRESS` | host address for the dashboard | `127.0.0.1` |
 | `TRAEFIK_API_INSECURE` | enable the local dashboard API | `true` |
 | `APP_PORT` | direct host port for FastAPI | `8000` |
 
@@ -149,6 +152,7 @@ The services are available at:
 - Traefik dashboard: <http://localhost:8080/dashboard/>
 
 The Compose configuration routes the hostname `localhost` through Traefik. The SQLite database is stored in the named Docker volume `linklog_data`, mounted at `/app/backend/data`.
+The application runs as a non-root user and reports container health through `/health`; Traefik waits for the application health check before starting.
 
 Stop the stack without deleting its database: